PT-2026-31578 · WordPress · Ultimate Accordion
Athiwat Tiprasaharn
+1
·
Published
2026-04-09
·
Updated
2026-04-10
·
CVE-2026-4336
CVSS v3.1
6.4
Medium
| Vector | AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
The Ultimate FAQ Accordion plugin for WordPress versions through 2.4.7
Description
The Ultimate FAQ Accordion plugin for WordPress is susceptible to Stored Cross-Site Scripting through FAQ content. This occurs because the plugin uses
html entity decode() on post content during rendering in the set display variables() function (View.FAQ.class.php, line 746), which converts HTML entity-encoded payloads back into executable HTML. Insufficient output escaping in the faq-answer.php template, where the decoded content is echoed without wp kses post() or other sanitization, further contributes to the issue. The ufaq custom post type is registered with show in rest set to true and defaults to the post capability type, allowing Author-level users to create and publish FAQs via the REST API. An attacker with Author-level access or higher can submit entity-encoded malicious HTML (e.g., <img src=x onerror=alert()>) that bypasses WordPress's kses sanitization at save time, but is then decoded back into executable HTML at render time. This allows the injection of arbitrary web scripts in FAQ pages that execute when a user accesses the injected FAQ, either directly or via the [ultimate-faqs] shortcode.Recommendations
Update to a version later than 2.4.7.
Fix
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Ultimate Accordion